Malicious Calendly and Google Meet Links Deliver Weaponized Zoom Extension | Cybersecurity Alert 2026

Table of Contents

• Introduction
• What Happened?
• Anatomy of the Attack
• Why This Attack Works
• What Is a Weaponized Extension?
• Indicators of Compromise (IOCs)
• Preventive Measures
•  Conclusion
•  Frequently Asked Questions (FAQs)

Introduction

In the ever-evolving landscape of cyber threats, attackers are now exploiting the trust users place in productivity and scheduling tools. A recent campaign has surfaced where malicious actors leveraged Calendly and Google Meet invite links to deliver a weaponized Zoom extension, resulting in compromised systems and stolen data. This blog explores how the attack unfolded, its techniques, and how users—especially professionals using collaboration platforms—can stay protected.

What Happened?

The attack begins innocuously—an external contact sends a meeting invite via Telegram, requesting a virtual meeting through Calendly. The Calendly link redirects users to a Google Meet event that appears entirely legitimate.

However, during the fake meeting setup, the victim is prompted with a common issue: a request to download a Zoom extension to resolve an alleged microphone or audio problem. This Zoom extension, however, is weaponized malware.

The real goal? Gaining control over the victim’s system or extracting sensitive information, all while pretending to troubleshoot a harmless meeting issue.

Anatomy of the Attack

Let’s break down how this multi-stage attack works:

1. Initial Lure via Social Engineering

• The attacker reaches out over Telegram, posing as a professional contact.

• They send a Calendly link, requesting to set up a meeting.

2. Redirect to a Fake Google Meet Invite

• Clicking the link takes the victim to a fabricated Google Meet page.

• Everything looks authentic, including branding and scheduling details.

3. Zoom-Based Distraction

• The attacker claims there’s a microphone issue and requests the victim to download a Zoom extension.

• The link is weaponized—likely a trojanized installer or a malicious browser extension.

4. Malware Execution

• Once installed, the malware may:

  • Monitor browser activity

  • Steal credentials

  • Enable remote access

  • Capture webcam or microphone feeds

Why This Attack Works

This social engineering campaign is effective because it:

• Leverages trusted platforms like Calendly and Google Meet

• Exploits natural urgency (fixing an audio issue quickly before a meeting)

• Uses Telegram for informal, fast communication

• Delivers malicious payloads disguised as productivity tools (Zoom extension)

The attack bypasses many user suspicions because everything seems part of a normal workflow.

What Is a Weaponized Extension?

A weaponized extension is a browser or app extension that appears to serve a legitimate purpose but has hidden malicious functions such as:

• Logging keystrokes

• Extracting cookies or session tokens

• Redirecting websites

• Capturing browser content

• Installing persistent backdoors

In this case, the Zoom extension was modified to deliver one or more of these payloads.

Indicators of Compromise (IOCs)

Victims may observe the following signs:

• Unusual Zoom behavior (auto-launching, crashing)

• New browser extensions they didn’t install

• Unauthorized access to meetings or online accounts

• Increased CPU/network usage from unknown processes

• Password reset emails from services they never accessed

Preventive Measures

To protect against such campaigns, users should:

Conclusion

This campaign serves as a strong reminder that social engineering remains a core tactic for cybercriminals, especially when combined with tools people trust like Calendly, Google Meet, and Zoom. As attackers become more creative, it’s essential for individuals and organizations to develop a proactive cybersecurity posture. By validating every invite and treating unexpected downloads with suspicion, users can avoid falling into traps—even those disguised as routine meetings.

Stay safe, stay skeptical, and never download extensions unless you’re absolutely sure of their origin.